sops-encryption

SOPS Encryption

Encrypt secrets in configuration files while keeping structure visible.

When to Use This Skill

Use this skill when:

• Encrypting secrets in Git
• Implementing GitOps with secrets
• Managing Kubernetes secrets as code
• Encrypting configuration files

Prerequisites

• SOPS installed
• KMS access (AWS, GCP, Azure) or PGP key

Installation

# macOS
brew install sops

# Linux
# Choose a supported release for the actual OS/architecture.
# Verify publisher signatures/checksums through an independent trusted channel
# before execution; use an authorized install destination.

Basic Usage

# Encrypt with AWS KMS
sops --encrypt --kms arn:aws:kms:region:account:key/key-id secrets.yaml > secrets.enc.yaml

# Decrypt only into a private authorized destination; never print plaintext in captured logs
# Review the installed SOPS output options before decrypting

# Edit encrypted file
sops secrets.enc.yaml

# Encrypt in place
sops --encrypt --in-place secrets.yaml

Configuration

# .sops.yaml
creation_rules:
  - path_regex: .*\.prod\.yaml$
    kms: arn:aws:kms:us-east-1:account:key/prod-key
  - path_regex: .*\.dev\.yaml$
    kms: arn:aws:kms:us-east-1:account:key/dev-key
  - path_regex: .*
    pgp: fingerprint

Kubernetes Integration

# encrypted secret
apiVersion: v1
kind: Secret
metadata:
  name: myapp-secrets
type: Opaque
stringData:
  password: ENC[AES256_GCM,data:encrypted...]
sops:
  kms:
    - arn: arn:aws:kms:region:account:key/key-id

# With ArgoCD
# Install ksops plugin for ArgoCD to decrypt secrets

Best Practices

• Store .sops.yaml in repository
• Use different keys per environment
• Rotate encryption keys regularly
• Never commit unencrypted secrets
• Use key aliases for readability

Related Skills

• hashicorp-vault (hashicorp-vault) - Centralized secrets
• argocd-gitops (argocd-gitops) - GitOps integration

Limitations

• Apply guidance only within authorized scope; test destructive steps in non-production first.
• Docs-only import: upstream scripts and templates not bundled.

Example

# Read-only first: inventory before any active step.
which <tool> && <tool> --help | head -n 20

Adapted from BagelHole/DevOps-Security-Agent-Skills (MIT); frontmatter, When to Use/Limitations, and safety boundaries added for upstream compliance. Docs-only import: helper scripts and templates not bundled.

Execution boundaries

Review encryption output before replacing originals. Decrypting to stdout can expose secrets in agent/tool logs. Use synthetic data for validation, restrict output permissions and never commit plaintext. The abbreviated encrypted Kubernetes example is illustrative, not a valid ciphertext to deploy.